@echomem/mcp 1.4.14 → 1.4.16

package/dist/index.js

@@ -13,8 +13,10 @@ import { createHash, randomUUID } from "node:crypto";
 import { fetchEncryptionConfig, decryptMemoryFields } from "./encryption.js";
 import { runCli } from "./setup.js";
 import { MCP_PACKAGE_VERSION, MCP_SERVER_INSTRUCTIONS } from "./package-metadata.js";
+import { clearBillingAlert, writeBillingAlert } from "./billing-alert.js";
 import { checkLatestUpdateStatus, formatUpdateNotice, formatUpdateStatusText, startBackgroundUpdateCheck, } from "./update-check.js";
 const ECHO_API_BASE_URL = process.env.ECHO_API_BASE_URL || "https://echo-mem-chrome.vercel.app";
+const ECHO_PRICING_URL = process.env.ECHO_PRICING_URL || "https://echoknows.com/pricing";
 /** Thrown when no API token is present yet — the model gets a "run login" nudge, not a hard error. */
 class NoTokenError extends Error {
 }
@@ -80,6 +82,56 @@ function describeError(error) {
     const fallback = stringifyErrorValue(error);
     return fallback || "Unknown error";
 }
+function appendPricingSource(url, source) {
+    try {
+        const parsed = new URL(url);
+        if (!parsed.searchParams.has("source")) {
+            parsed.searchParams.set("source", source);
+        }
+        return parsed.toString();
+    }
+    catch {
+        return url;
+    }
+}
+function formatUpgradeRequiredResult(error) {
+    if (!axios.isAxiosError(error))
+        return null;
+    const status = error.response?.status;
+    if (status !== 402 && status !== 403 && status !== 429)
+        return null;
+    const data = error.response?.data;
+    if (!isRecord(data))
+        return null;
+    const upgradeUrl = readString(data, "upgradeUrl")
+        ?? readString(data, "pricingUrl")
+        ?? readString(data, "url")
+        ?? ECHO_PRICING_URL;
+    const message = readString(data, "message")
+        ?? "Memory search and recall require an Echo Pro or Power plan.";
+    const code = readString(data, "error") ?? readString(data, "code");
+    const plan = readString(data, "plan");
+    const pricingUrl = appendPricingSource(upgradeUrl, "mcp_search");
+    const normalizedCode = String(code || "").toUpperCase();
+    const kind = status === 429 || normalizedCode.includes("QUOTA") || normalizedCode.includes("LIMIT")
+        ? "quota_exceeded"
+        : status === 402 || normalizedCode.includes("REQUIRES_PLAN")
+            ? "plan_required"
+            : "billing_attention";
+    writeBillingAlert({
+        kind,
+        code,
+        message,
+        plan,
+        pricingUrl,
+    });
+    return [
+        message,
+        "",
+        code ? `Reason: ${code}.` : "",
+        `Open pricing: ${pricingUrl}`,
+    ].filter(Boolean).join("\n");
+}
 /** Map a thrown error to the telemetry error_kind taxonomy. */
 function classifyError(error) {
     if (error instanceof NoTokenError)
@@ -105,6 +157,11 @@ function readNumber(record, key) {
     const value = record[key];
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
+function errorCodeFrom(value) {
+    if (!isRecord(value))
+        return undefined;
+    return readString(value, "error") || readString(value, "code") || readString(value, "errorCode");
+}
 function compactOneLine(value, maxLength) {
     if (!value)
         return undefined;
@@ -569,30 +626,59 @@ class EchoMemApiClient {
             throw error;
         }
     }
-    async searchMemoriesRaw(query, opts, enc, retrievalOnly = false) {
-        const response = await this.axios.post("/api/extension/memories/search", {
-            query,
-            k: opts.limit,
-            similarityThreshold: opts.threshold,
-            timeFrameDays: opts.timeFrameDays,
-            requestId: opts.requestId,
-            sessionId: this.sessionId,
-        });
+    async searchMemoriesRaw(query, opts, enc, retrievalOnly = false, trace) {
+        const endpoint = "/api/extension/memories/search";
+        let response;
+        try {
+            response = await this.axios.post(endpoint, {
+                query,
+                k: opts.limit,
+                similarityThreshold: opts.threshold,
+                timeFrameDays: opts.timeFrameDays,
+                requestId: opts.requestId,
+                sessionId: this.sessionId,
+            });
+            trace?.({ requestId: opts.requestId, endpoint, httpStatus: response.status });
+        }
+        catch (error) {
+            trace?.({
+                requestId: opts.requestId,
+                endpoint,
+                httpStatus: axios.isAxiosError(error) ? error.response?.status : undefined,
+                errorCode: axios.isAxiosError(error) ? errorCodeFrom(error.response?.data) : undefined,
+            });
+            throw error;
+        }
         const data = enc.enabled ? await this.decryptResult(response.data, enc.key) : response.data;
         return retrievalOnly && isRecord(data)
             ? { ...data, retrievalOnly: true, tuned: false }
             : data;
     }
-    async searchMemoriesRetrieved(query, opts, enc) {
-        const response = await this.axios.post("/api/extension/memories/deep-search/candidates", {
-            query,
-            requestId: opts.requestId,
-            logicalRequestId: opts.requestId,
-            sessionId: this.sessionId,
-            userTimeZone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
-        });
+    async searchMemoriesRetrieved(query, opts, enc, trace) {
+        const endpoint = "/api/extension/memories/deep-search/candidates";
+        let response;
+        try {
+            response = await this.axios.post(endpoint, {
+                query,
+                requestId: opts.requestId,
+                logicalRequestId: opts.requestId,
+                sessionId: this.sessionId,
+                userTimeZone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
+            });
+            trace?.({ requestId: opts.requestId, endpoint, httpStatus: response.status });
+        }
+        catch (error) {
+            trace?.({
+                requestId: opts.requestId,
+                endpoint,
+                httpStatus: axios.isAxiosError(error) ? error.response?.status : undefined,
+                errorCode: axios.isAxiosError(error) ? errorCodeFrom(error.response?.data) : undefined,
+            });
+            throw error;
+        }
         const data = response.data ?? {};
         if (data.success === false) {
+            trace?.({ requestId: opts.requestId, endpoint, httpStatus: response.status, errorCode: errorCodeFrom(data) });
             throw new Error(`deep-search candidates proxy error: ${data.error || "unknown"}`);
         }
         const rawCandidates = Array.isArray(data.personalCandidates) ? data.personalCandidates : [];
@@ -648,16 +734,31 @@ class EchoMemApiClient {
     // never hits dg-web directly, so no new auth is needed and no other caller is
     // disrupted. NOTE: encrypted users still get server-side plaintext only; the
     // phase-1 + bridge-local-decrypt + phase-2 flow (spec §11) is the remaining work.
-    async searchMemoriesTuned(query, requestId) {
-        const response = await this.axios.post("/api/extension/memories/deep-search", {
-            query,
-            requestId,
-            logicalRequestId: requestId,
-            sessionId: this.sessionId,
-            userTimeZone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
-        });
+    async searchMemoriesTuned(query, requestId, trace) {
+        const endpoint = "/api/extension/memories/deep-search";
+        let response;
+        try {
+            response = await this.axios.post(endpoint, {
+                query,
+                requestId,
+                logicalRequestId: requestId,
+                sessionId: this.sessionId,
+                userTimeZone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
+            });
+            trace?.({ requestId, endpoint, httpStatus: response.status });
+        }
+        catch (error) {
+            trace?.({
+                requestId,
+                endpoint,
+                httpStatus: axios.isAxiosError(error) ? error.response?.status : undefined,
+                errorCode: axios.isAxiosError(error) ? errorCodeFrom(error.response?.data) : undefined,
+            });
+            throw error;
+        }
         const data = response.data ?? {};
         if (data.success === false) {
+            trace?.({ requestId, endpoint, httpStatus: response.status, errorCode: errorCodeFrom(data) });
             throw new Error(`deep-search proxy error: ${data.error || "unknown"}`);
         }
         const primary = (data.retrievedMemorySnapshot?.primary ?? []);
@@ -669,7 +770,7 @@ class EchoMemApiClient {
         }));
         return { success: true, tuned: true, answer: String(data.answer || data.response || "").trim(), memories };
     }
-    async searchMemories(args) {
+    async searchMemories(args, trace) {
         const parsed = searchMemoriesSchema.parse(args ?? {});
         const query = parsed.query?.trim();
         const limit = parsed.limit ?? parsed.k ?? 10;
@@ -695,17 +796,17 @@ class EchoMemApiClient {
             requestId: randomUUID(),
         };
         if (!parsed.includeAnswer) {
-            return this.searchMemoriesRetrieved(query, searchOpts, enc);
+            return this.searchMemoriesRetrieved(query, searchOpts, enc, trace);
         }
         // Encrypted account: the server can't synthesize over plaintext it doesn't hold, so use the raw
         // retriever (returns ciphertext) and decrypt locally — zero-knowledge preserved end-to-end.
         if (enc.enabled) {
-            return await this.searchMemoriesRaw(query, searchOpts, enc);
+            return await this.searchMemoriesRaw(query, searchOpts, enc, false, trace);
         }
         // A synthesized answer is metered through the legacy route. Do not fall
         // back to raw retrieval after a ledger outage: that would return a result
         // without a durable usage fact.
-        return this.searchMemoriesTuned(query, searchOpts.requestId);
+        return this.searchMemoriesTuned(query, searchOpts.requestId, trace);
     }
     /** Decrypt the model-visible fields on a `{ memories: [...] }` response locally. */
     async decryptResult(data, key) {
@@ -1101,6 +1202,12 @@ class EchoMemMCPServer {
                 if (error instanceof McpError) {
                     throw error;
                 }
+                const upgradeRequired = formatUpgradeRequiredResult(error);
+                if (upgradeRequired) {
+                    return {
+                        content: [{ type: "text", text: upgradeRequired }],
+                    };
+                }
                 return {
                     content: [{ type: "text", text: `Error: ${describeError(error)}` }],
                     isError: true,
@@ -1129,6 +1236,13 @@ class EchoMemMCPServer {
                         map_injected: rec.map_injected,
                         encrypted_user: rec.encrypted,
                         extracted_memory_count: rec.memories_extracted,
+                        // Preserve only the safe correlation fields needed to join a
+                        // bridge-local failure to the central operational trace. Query
+                        // text and upstream bodies never leave the local event stream.
+                        request_id: rec.request_id,
+                        endpoint: rec.endpoint,
+                        http_status: rec.http_status,
+                        error_code: rec.error_code ?? (rec.error_kind === "none" ? undefined : rec.error_kind),
                     };
                     void this.client.trackMcpAnalyticsEvent(rec.ok ? "[MCP] EchoMem Tool Succeeded" : "[MCP] EchoMem Tool Failed", finalAnalytics, `${analyticsCallId}:generic-completed`);
                     void this.client.trackMcpAnalyticsEvent(toolEventName(canonicalName, rec.ok ? "Succeeded" : "Failed"), finalAnalytics, `${analyticsCallId}:completed`);
@@ -1142,7 +1256,15 @@ class EchoMemMCPServer {
             rec.query_len = query.length;
             rec.query_hash = hashText(query);
         }
-        const result = await this.client.searchMemories(args);
+        const result = await this.client.searchMemories(args, (trace) => {
+            if (!rec)
+                return;
+            rec.request_id = trace.requestId;
+            rec.endpoint = trace.endpoint;
+            rec.http_status = trace.httpStatus;
+            rec.error_code = trace.errorCode;
+        });
+        clearBillingAlert();
         if (rec) {
             // "Which memories were used": topic keys + delivered context size, for the comparison dataset.
             const mems = Array.isArray(result?.memories) ? result.memories : [];
@@ -1249,7 +1371,7 @@ Details: ${m.details || "N/A"}`)
                 typeof capsuleId === "string" && capsuleId ? `Capsule ID: ${capsuleId}` : "",
                 typeof contextId === "string" && contextId ? `Context: ${contextId}` : "",
                 "",
-                `To reload this capsule in a fresh session: get_memories_by_context({ contextId: "${contextId}" })`,
+                `To reload this capsule in a fresh session with Pro/Power recall: get_memories_by_context({ contextId: "${contextId}" })`,
             ].filter(Boolean).join("\n");
             return { content: [{ type: "text", text }] };
         }
@@ -1273,7 +1395,7 @@ Details: ${m.details || "N/A"}`)
             `Successfully ingested conversation. Extracted ${memoriesExtracted} memory distinct events.`,
             list,
             saved.length
-                ? `Verify these captured the key facts. To re-fetch this exact batch later, search by the ids above${typeof contextId === "string" && contextId ? ` (context ${contextId})` : ""}.`
+                ? `Verify these captured the key facts. With Pro/Power recall, re-fetch this exact batch later by searching the ids above${typeof contextId === "string" && contextId ? ` (context ${contextId})` : ""}.`
                 : "",
         ].filter(Boolean).join("\n\n");
         return { content: [{ type: "text", text }] };

package/dist/setup-page/client-core.js

@@ -21,6 +21,8 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
       var reportMounted = false;    // report shell (city iframe) mounted once; loading is an overlay on it, not a separate page
       var authUrl = "";
       var workspacePath = "";
+      var billingStatus = null;
+      var recallGateSkipped = false;
       var authWindow = null;
       var connectionPollStarted = false;
       var statsPollStarted = false;

package/dist/setup-page/client-extraction.js

@@ -342,7 +342,7 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
                       '<div class="resultNumber"><strong>' + esc(number(extracted)) + '</strong><span>' + esc(memoryNoun) + '</span></div>') +
                 '</div>' +
               '</div>' +
-              (done ? tryItCard() : "") +
+              (done ? recallGateBlock() : "") +
               (done ? "" :
                 '<div class="memoryReceipt">' +
                   '<p class="receiptK">What just happened</p>' +
@@ -353,7 +353,7 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
                 '</div>') +
             '</div>' +
             (done ? hudTip() + doneCloseNote() : "");
-          wireTryButtons();
+          wireRecallGate();
           return;
         }
         setHead(preparing ? "Preparing" : "Extracting", preparing ? "Preparing" : "Extracting");
@@ -447,6 +447,103 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
           setLaunchStatus(msg);
         }
       }
+      function paidRecallPlan(plan) {
+        return ["pro", "power", "team", "enterprise"].indexOf(String(plan || "").toLowerCase()) >= 0;
+      }
+      function recallPricingUrl() {
+        return (billingStatus && billingStatus.pricingUrl)
+          || "https://echoknows.com/pricing?source=mcp_onboarding";
+      }
+      function recallGateUnlocked() {
+        return recallGateSkipped || paidRecallPlan(billingStatus && billingStatus.plan);
+      }
+      function recallTrialAvailable() {
+        return !billingStatus || billingStatus.trialAvailable !== false;
+      }
+      function recallGateBlock() {
+        var unlocked = recallGateUnlocked();
+        var trialAvailable = recallTrialAvailable();
+        return '<div class="recallGateBlock">' +
+          '<section class="recallGate' + (unlocked ? " is-hidden" : "") + '" id="recallGate">' +
+            '<p class="recallEyebrow"><i></i>Premium recall</p>' +
+            '<h3 id="recallGateTitle">' + (trialAvailable ? "Unlock memory search for your agents." : "Ready to turn recall back on?") + '</h3>' +
+            '<p id="recallGateBody">' + (trialAvailable ? "Start a 14-day trial and let Codex, Claude, and MCP clients search what Echo saved. Saving conversations keeps working either way." : "Choose Pro or Power to let Codex, Claude, and MCP clients search what Echo saved. Saving conversations keeps working either way.") + '</p>' +
+            '<div class="recallTrial' + (trialAvailable ? "" : " is-hidden") + '" id="recallTrialBadge" aria-label="14 days free"><strong>14</strong><span>days free<br>then choose what fits</span></div>' +
+            '<p class="recallUsedNote' + (trialAvailable ? " is-hidden" : "") + '" id="recallUsedNote">Your trial was already used. You can still unlock recall by choosing Pro or Power.</p>' +
+            '<div class="recallGateActions">' +
+              '<button type="button" class="primary" id="recallStartTrial">' + (trialAvailable ? "Compare Pro and Power" : "See pricing") + '</button>' +
+              '<button type="button" class="textButton" id="recallSkip">Skip recall for now</button>' +
+            '</div>' +
+            '<p class="recallFine" id="recallFine">' + (trialAvailable ? "Card required for trial. Cancel anytime." : "Cancel anytime.") + '</p>' +
+            '<p class="launchStatus" id="recallGateStatus"></p>' +
+          '</section>' +
+          '<div id="recallTryWrap" class="recallTryWrap' + (unlocked ? "" : " is-hidden") + '">' +
+            '<p id="recallSkipNote" class="recallSkipNote' + (recallGateSkipped ? "" : " is-hidden") + '">Saving will keep working. Search and recall require Pro or Power when this prompt calls <code>search_memories</code>.</p>' +
+            tryItCard() +
+          '</div>' +
+        '</div>';
+      }
+      function setRecallGateStatus(message) {
+        var node = document.getElementById("recallGateStatus");
+        if (node) node.textContent = message || "";
+      }
+      function applyRecallGate() {
+        var gate = document.getElementById("recallGate");
+        var wrap = document.getElementById("recallTryWrap");
+        var skipNote = document.getElementById("recallSkipNote");
+        var unlocked = recallGateUnlocked();
+        if (gate) gate.classList.toggle("is-hidden", unlocked);
+        if (wrap) wrap.classList.toggle("is-hidden", !unlocked);
+        if (skipNote) skipNote.classList.toggle("is-hidden", !recallGateSkipped);
+        var trialAvailable = recallTrialAvailable();
+        var badge = document.getElementById("recallTrialBadge");
+        if (badge) badge.classList.toggle("is-hidden", !trialAvailable);
+        var usedNote = document.getElementById("recallUsedNote");
+        if (usedNote) usedNote.classList.toggle("is-hidden", trialAvailable);
+        var title = document.getElementById("recallGateTitle");
+        if (title) title.textContent = trialAvailable ? "Unlock memory search for your agents." : "Ready to turn recall back on?";
+        var body = document.getElementById("recallGateBody");
+        if (body) body.textContent = trialAvailable
+          ? "Start a 14-day trial and let Codex, Claude, and MCP clients search what Echo saved. Saving conversations keeps working either way."
+          : "Choose Pro or Power to let Codex, Claude, and MCP clients search what Echo saved. Saving conversations keeps working either way.";
+        var cta = document.getElementById("recallStartTrial");
+        if (cta) cta.textContent = trialAvailable ? "Compare Pro and Power" : "See pricing";
+        var fine = document.getElementById("recallFine");
+        if (fine) fine.textContent = trialAvailable ? "Card required for trial. Cancel anytime." : "Cancel anytime.";
+      }
+      async function refreshBillingStatus() {
+        try {
+          billingStatus = await getJson("/billing-status");
+          applyRecallGate();
+          if (!recallGateUnlocked() && billingStatus && billingStatus.plan === "unknown") {
+            setRecallGateStatus("Could not check your plan. You can start the trial or skip and keep setup going.");
+          }
+        } catch (_) {
+          setRecallGateStatus("Could not check your plan. You can start the trial or skip and keep setup going.");
+        }
+      }
+      function openRecallPricing() {
+        var url = recallPricingUrl();
+        setRecallGateStatus("Opening pricing in a new tab...");
+        try {
+          var opened = window.open(url, "_blank", "noopener,noreferrer");
+          if (!opened) setRecallGateStatus("Your browser blocked the pricing tab. Allow pop-ups for this page, then click Compare plans again.");
+        } catch (_) {
+          setRecallGateStatus("Could not open a new tab. Allow pop-ups for this page, then click Compare plans again.");
+        }
+      }
+      function skipRecallGate() {
+        recallGateSkipped = true;
+        applyRecallGate();
+      }
+      function wireRecallGate() {
+        var trialBtn = document.getElementById("recallStartTrial");
+        if (trialBtn) trialBtn.addEventListener("click", openRecallPricing);
+        var skipBtn = document.getElementById("recallSkip");
+        if (skipBtn) skipBtn.addEventListener("click", skipRecallGate);
+        wireTryButtons();
+        void refreshBillingStatus();
+      }
       function tryItCard() {
         var prompt = recallPrompt();
         return '<div class="tryCard">' +
@@ -500,10 +597,10 @@ export const SETUP_PAGE_CLIENT_EXTRACTION = String.raw `      /* ---------- dash
             '<span class="seal">Skipped for now</span>' +
             '<h2>You can come back anytime.</h2>' +
             '<p>Echo saved what already finished. When you are ready, run <code>echomem-mcp init</code> again — it picks up right where it left off.</p>' +
-            tryItCard() +
+            recallGateBlock() +
             hudTip() +
           '</div>';
-        wireTryButtons();
+        wireRecallGate();
       }
       async function endExtraction() {
         if (extractionEnded) return;

package/dist/setup-page/client-lifecycle.js

@@ -1,5 +1,71 @@
 // Generated by splitting the previous inline setup page. Keep this source readable: it is emitted into one browser IIFE.
 export const SETUP_PAGE_CLIENT_LIFECYCLE = String.raw `      /* ---------- scan-first poll for the forensic report ---------- */
+      function renderLocalScanConsent() {
+        setScanMode(false);
+        setCityMode(false);
+        setExtractMode(false);
+        setReadyMode(false);
+        setHead("Local file access", "Consent");
+        app.className = "consentStage";
+        app.innerHTML =
+          '<section class="localConsent">' +
+            '<p class="consentEyebrow">Local visualization</p>' +
+            '<h2>Let Echo scan locally to build your Agent Doctor view?</h2>' +
+            '<p>Echo reads local Codex and Claude Code history on this machine only, then turns it into a private usage visualization. Nothing from this scan leaves your device.</p>' +
+            '<div class="consentActions">' +
+              '<button type="button" class="primary" id="allowLocalScan">Continue with local scan</button>' +
+              '<button type="button" class="textButton" id="declineLocalScan">Skip the insight for now</button>' +
+            '</div>' +
+            '<p class="consentFine" id="consentStatus"></p>' +
+          '</section>';
+        var allow = document.getElementById("allowLocalScan");
+        if (allow) allow.onclick = allowLocalScan;
+        var decline = document.getElementById("declineLocalScan");
+        if (decline) decline.onclick = declineLocalScan;
+      }
+      function setConsentStatus(message) {
+        var node = document.getElementById("consentStatus");
+        if (node) node.textContent = message || "";
+      }
+      async function allowLocalScan() {
+        setConsentStatus("Starting local scan...");
+        try {
+          await postJson("/report-consent", { allowed: true });
+          await showReport();
+        } catch (error) {
+          renderReportIssue("CONSENT_SAVE_FAILED", error && error.message ? error.message : "Could not start the local scan.");
+        }
+      }
+      async function declineLocalScan() {
+        setConsentStatus("Skipping Agent Doctor...");
+        try {
+          await postJson("/report-consent", { allowed: false });
+        } catch (_) {}
+        renderLocalScanSkipped();
+      }
+      function renderLocalScanSkipped() {
+        setScanMode(false);
+        setCityMode(false);
+        setExtractMode(false);
+        setReadyMode(true);
+        setHead("Agent Doctor skipped", connected ? "Signed in" : "Optional");
+        app.className = "consentStage";
+        app.innerHTML =
+          '<section class="localConsent">' +
+            '<p class="consentEyebrow">Visualization skipped</p>' +
+            '<h2>No problem. Echo can still set up memory.</h2>' +
+            '<p>We will skip Agent Doctor and continue with EchoMem setup.</p>' +
+            '<div class="consentActions">' +
+              '<button type="button" class="primary" data-connect-echo>' + (connected ? "Continue setup" : "Connect EchoMem") + '</button>' +
+              '<button type="button" class="textButton" id="changeConsent">Go back</button>' +
+            '</div>' +
+            '<p class="consentFine" data-signin-help></p>' +
+            '<a class="button secondary hidden" data-signin-fallback target="_blank" rel="noopener noreferrer">Open sign-in</a>' +
+          '</section>';
+        bindConnect();
+        var change = document.getElementById("changeConsent");
+        if (change) change.onclick = renderLocalScanConsent;
+      }
       async function showReport() {
         if (reportPollStarted) return;
         reportPollStarted = true;
@@ -103,14 +169,14 @@ export const SETUP_PAGE_CLIENT_LIFECYCLE = String.raw `      /* ---------- scan-
           }
           return;
         }
-        // Learn the auth URL + connection state, but don't block the local scan on it.
-        getJson("/config").then(function (cfg) {
+        // Learn the auth URL + connection state before asking for optional local file access.
+        try {
+          var cfg = await getJson("/config");
           authUrl = cfg.authUrl || authUrl;
           connected = !!cfg.connected;
           workspacePath = cfg.workspacePath || workspacePath;
-        }).catch(function () {});
-        // Scan-first: show the local forensic report before asking the user to connect.
-        await showReport();
+        } catch (_) {}
+        renderLocalScanConsent();
       }
       __ECHO_SETUP_STARTUP__;
 `;

package/dist/setup-page/document.js

@@ -11,7 +11,7 @@ const SETUP_PAGE_BODY = String.raw `
       </div>
       <div class="pill" id="status">Local</div>
     </header>
-    <section id="app" class="state">Starting local scan...</section>
+    <section id="app" class="state">Preparing setup...</section>
   </main>
   <dialog id="echo-note" class="echo-note-dlg">
     <button class="nclose" aria-label="Close">&times;</button>